Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-32189

CVE-2022-32189HIGH

Go standard library math/big — Panic when decoding Float and Rat types in math/big

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0263   85.3     —

AFFECTED
  Product   Versions     Fixed
  math/big  unspecified  —

TIMELINE
  May 31  Reserved by Go
  Aug 9   Published (CNA: Go)
  Oct 8   ENRICHED — CVE-2022-32189 (Go standard library math/big). Received CVSS 7.5 and CPE data from NVD.
  Oct 8   EXPLOIT PUBLISHED — CVE-2022-32189 (Go standard library math/big). Public exploit reference added.

CNA: Go · CVSS v3.1 · 5 references · NVD status: Modified

Description

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
May 31, 2022	Reserved	Reserved by Go
August 9, 2022	Published	Published (CNA: Go)
October 8, 2026	ENRICHED	ENRICHED — CVE-2022-32189 (Go standard library math/big). Received CVSS 7.5 and CPE data from NVD.
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2022-32189 (Go standard library math/big). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Go standard library	math/big	—	—	—

References (5)

https://go.dev/cl/417774 [Patch]
https://go.dev/issue/53871 [Exploit, Third Party Advisory]
https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66 [Mailing List, Patch]
https://groups.google.com/g/golang-announce/c/YqYYG87xB10 [Mailing List, Third Party Advisory]
https://pkg.go.dev/vuln/GO-2022-0537 [Vendor Advisory]

Authoritative record: CVE-2022-32189 at cve.org

Vendors: go standard library

About this page